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SELECT A PORTION OF EXECUTING 
SOFTWARE FROM THE WORKING SET 

201 



DETERMINE WHETHER CODE 
OR DATA. 
202 




COMPUTE THE FINGERPRINT FROM THE 
OP CODES OF THE PORTION AS A HASH 
FUNCTION VALUE OF THE SEQUENCE OFj 
THE OPCODES. 
204 



COMPUTE THE FINGERPRINT AS 
A DIGEST OF THE DATA. 
205 



FIG. 2 
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COMPUTE A SET OF FINGERPRINTS FOR EACH OF SEVERAL 
EXECUTIONS OF SOFTWARE S. CALL THE RESULT AllSets. 

301 








FIND ALL FINGERPRINTS THAT ARE IN EVERY SET IN AllSets. 
CALL THESE CandidateFinger. FIND THE FINGERPRINTS 
THAT ARE IN ANY SET OF AllSets. CALL THEM AIIFinger. 
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FIND THOSE FINGERPRINTS IN CandidateFinger THAT ARE 
ABSENT FROM THE AIIFinger SETS OF ALL SOFTWARE 
OTHER THAN S. THAT RESULT IS CALLED GoldenFinger. 

303 






A SUPERFINGERPRINT FOR S IS SPECIFIED SUBSET 

OF GoldenFinger. 
304 



FIG. 3 
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COMPARE THE FINGERPRINTS IN COLLECTION A TO THOSE 
IN SUPERFINGERPRINT B. CALL THOSE IN COMMON 
CommonFinger.CALL THOSE THAT ARE IN EITHER AOR B 
EitherFinger. LET MatchingRatio = SIZE OF 
CommonFinger DIVIDED BY SIZE OF EitherFinger. 

401 




COLLECTION A IS AN 
INSTANCE OF NameB. 
403 



COLLECTION A IS NOT AN 
INSTANCE OF NameB. 
404 



FIG. 4 
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PARTITION THE SOFTWARES INTO GROUPS. 
LET GROUP B CONSIST OF si, , sk. 
501 



FOR GROUP G, FIND THE SUPERFINGERPRINT THAT 
DISTINGUISHES G FROM ALL OTHER GROUPS, 
CALL THAT GroupSuperFingerprint(G). FIND THE 
SUPERFINGERPRINT FOR EACH si WITHIN G 
THAT DISTINGUISHES si FROM ALL OTHER SOFTWARES 
WITHIN G, CALL THAT lnGroupSuperfingerprint(si, G). 
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FIG. 5 
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LET GROUP G CONSIST OF SOFTWARES Si, ...,Sk. FOR 
EACH SOFTWARE Si IN G, COMPUTE A SET OF FINGERPRINTS 
FOR EACH OF SEVERAL EXECUTIONS OF THE SOFTWARE Si. 
CALL THE RESULT AHSets(Si). FIND ALL FINGERPRINTS THAT 
ARE IN EVERY SET IN AHSets(Si). CALL THESE 
CandidateFinger(Si). FIND THE FINGERPRINTS THAT ARE 
IN ANY SET OF AHSets(Si). CALL THEM AIIFinger(Si). 

601 



FIND THOSE FINGERPRINTS IN CandidateFinger(Si) THAT ARE 
ABSENT FROM AIIFinger(Sj) FOR ALL j UNEQUAL TO i. 
THAT RESULT IS CALLED InGroup GoldenFinger(Si, G) 
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lnGroupSuperFingerprint(Si, G) ISA 
SUBSET OF lnGroupGoldenFinger(Si, G). 
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FIG. 6 
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LET GROUP G CONSIST OF SOFTWARES S1 , .... Sk. 
FOR EACH SOFTWARE Si IN G, COMPUTE A SET OF 
FINGERPRINTS FOR EACH OF SEVERAL EXECUTIONS 

CALL THE RESULT AHSets(Si). FIND ALL 
FINGERPRINTS THAT ARE IN EVERY SET IN AllSets(Si). 
CALL THESE CandidateFinger(Si). FIND THE 
FINGERPRINTS THAT ARE IN ANY SET OF AllSets(Si). 
CALL THEM AIIFinger(Si). 
701 



I 

FORM THE UNION OF CandidateFinger(S1 ), 

CandidateFinger(S2) CandidateFinger(Sk). 

CALL THAT GroupCandidateFinger(G). 

FORM THE UNION OF AIIFinger(SI), AIIFinger(S2), .... 

AIIFinger(Sk). 

CALL THAT GroupAIIFinger(G). 

702 



FIND THOSE ELEMENTS OF GroupCandidateFinger(G) THAT 
ARE ABSENT FROM THE GroupAIIFinger SETS OF ALL 
GROUPS OTHER THAN G. THAT RESULT IS 
CALLED GroupGoldenFinger(G). 
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GroupSuperFingerprint(G) IS A SUBSET OF 
GroupGoldenFinger(G). 
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FIG. 7 
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1002 



f1 



f2 



f3 



Software A 



Software B, Software C 



Software A, Software B 
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1006 
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FIG. 10 



GIVEN f, USE A HASH FUNCTION 
TO FIND AN ENTRY IN A TABLE 
ASSOCIATED WITH f. 
1101 



RECORD THE SOFTWARES 
ASSOCIATED WITH f. 
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FIG. 11 



